Site Traffic Shaper Playbook

Overview

Purpose of this playbook

This playbook helps network administrators, IT managers, and Cato partners understand, configure, and validate bandwidth enforcement on Cato sites, so that traffic stays within each site's licensed limits and available capacity goes to the applications that matter most.

What you will be able to do

After reading this playbook, you will be able to identify sites experiencing bandwidth issues, pinpoint the root cause, and apply the right settings to resolve them.

Prerequisites

All you need is access to your Cato Management Application (CMA) account and to the Cato Knowledge Base.

What is the Site Traffic Shaper?

In Cato, the Site Traffic Shaper enforces each site's bandwidth so that its traffic does not exceed the bandwidth defined by the site's license. When a site tries to consume more than its licensed capacity, the shaper drops the excess traffic, keeping the site within its allocation and ensuring predictable performance. That means that traffic that exceeds the license is discarded.
Beyond enforcement, the Site Traffic Shaper gives administrators visibility into how bandwidth is used across the account. It helps you quickly identify which sites are overconsuming, understand what is driving that consumption, and take the right action to bring each site back in line with its license.

How the Site Traffic Shaper Works

Where shaping is enforced

The Site Traffic Shaper is enforced at both the Socket and the Cato PoP, covering upstream and downstream traffic. Enforcing in both directions ensures the site stays within its licensed bandwidth whether traffic is leaving the site or arriving at it.

How shaping interacts with QoS and multi-link sites

The Site Traffic Shaper enforces the site license first, before QoS or multi-link settings are applied. Only after the site's traffic is kept within its licensed bandwidth are other bandwidth decisions made, such as traffic prioritization or link selection.

Assessing Bandwidth Consumption

Start by getting a clear picture of bandwidth consumption across all sites in your account:

Log in to your CMA account and navigate to the Network > Network Overview page.
Review the consolidated view of bandwidth usage across your sites.
Compare each site's actual consumption with its licensed bandwidth allocation.
Note any sites consuming more than their license allocation. These are the sites to focus on in the rest of this playbook.

Verify each site's license and allocation

Because the Site Traffic Shaper enforces bandwidth based on each site's license, making sure every site has the correct license and allocation is the most important step in this playbook. If a site's allocation does not reflect its actual needs, the shaper will limit its traffic accordingly, which can affect application performance.

For each site identified above, check which license type it uses: a Site license, which provides a fixed bandwidth for that specific site, or a Pool license, where the site receives an allocation from a shared bandwidth pool.
You can view each site’s license type and, for Pool licenses, its allocated bandwidth on the site’s General configuration page. Make a list of sites whose license or allocation needs to be adjusted.

Analyzing and Resolving Overconsumption

Analyze site traffic

For each site that needs attention, do the following:

In the CMA, go to Network > Sites, and select the site.
Open the site's Network Analytics page and select the Site tab.
The graph shows the site's license limit as a dotted line.
Traffic above this line indicates that the site is consuming more bandwidth than its license allows and is being shaped.
IMPORTANT: Once the Traffic Shaper is enabled, when a site exceeds its licensed bandwidth, the excess traffic is discarded to keep the site within its license limit.

As shown below, when a site exceeds its licensed bandwidth, the Site Traffic Shaper discards the excess traffic to keep the site within its license limit.

For more information, see this article.

Rebalance your pool license allocation

If you use a Pool license, you can adjust the bandwidth allocated to each site. Consider reducing the allocation on sites whose consumption is well below their limit, and reallocating the available bandwidth to sites that are overconsuming. Managing your pool this way can often resolve issues at problematic sites without expanding your pool license.
For more information, see this article.

Options for site licenses

With a Site license, bandwidth cannot be moved between sites. If a site is still overconsuming after you have configured bypass and QoS, consider expanding the site's license, moving to a Pool license, or switching to the Bursting license mode.

Prioritize important traffic with QoS

After configuring bypass, review your Bandwidth Management (QoS) configuration to keep each site within its licensed bandwidth. QoS lets you prioritize different types of traffic over the tunnel to the Cato PoP. Bandwidth Management profiles let you proactively limit bandwidth and traffic bursts, which prevents the site from exceeding its license. If you need to assign QoS for specific applications, use Network Rules to map each application to the appropriate profile.

To configure Bandwidth Management at the account level, go to Network > Bandwidth Management and adjust the bandwidth limits.
- You can also customize the settings for specific sites, select a site and go to the Bandwidth Management page.
To assign applications to a profile, go to Network > Network Rules.

Identify top consumers and consider bypass

Open the site's App Analytics page to identify the applications consuming the most bandwidth.
Decide whether each application needs to be routed through Cato or can be bypassed so it's bandwidth is excluded from the site's license.
To bypass traffic, go to Network > Bypass, and add the relevant applications to the bypass policy.
Note: Bypassed traffic is not inspected or protected by Cato's security services, so bypass only traffic you trust. Cato recommends that you only bypass for software updates.
For more information, see this article.

For more information

Read more about the Site Traffic Shaper here
Contact your Cato Customer Success Manager, Sales Engineer, or Account Manager.